--- title: TanStack npm packages compromised in active supply chain... description: On May 11, 2026, attackers from TeamPCP published 84 malicious versions across 42 @tanstack/* npm packages in six minutes by chaining three vulnerabilities: a... canonical: https://daily.dev/posts/tanstack-npm-packages-compromised-in-active-supply-chain-attack-spreading-across-the-ecosystem-rjww2uayh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: TanStack npm packages compromised in active supply chain attack spreading across the ecosystem | daily.dev og:description: On May 11, 2026, attackers from TeamPCP published 84 malicious versions across 42 @tanstack/* npm packages in six minutes by chaining three vulnerabilities: a... og:url: https://daily.dev/posts/tanstack-npm-packages-compromised-in-active-supply-chain-attack-spreading-across-the-ecosystem-rjww2uayh og:image: https://api.daily.dev/og/posts/RJWW2Uayh.png og:image:alt: TanStack npm packages compromised in active supply chain attack spreading across the ecosystem og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # TanStack npm packages compromised in active supply chain attack spreading across the ecosystem **[Collections](https://daily.dev/sources/collections)** · 4 min read · 5 upvotes · 0 comments ## Summary On May 11, 2026, attackers from TeamPCP published 84 malicious versions across 42 @tanstack/* npm packages in six minutes by chaining three vulnerabilities: a GitHub Actions pull_request_target misconfiguration (Pwn Request), pnpm cache poisoning, and OIDC token extraction from runner memory. The attack bypassed SLSA Build Level 3 provenance because the malicious packages were published through the real CI/CD pipeline. The payload harvested credentials from AWS, GCP, Kubernetes, Vault, GitHub, npm, and SSH keys; searched for Claude Code session history; exfiltrated data via the Session/Oxen P2P network; self-propagated using stolen npm tokens; and included a destructive wiper for certain locale settings. A dead man's switch wipes the home directory if credentials are rotated before persistence mechanisms are removed. Remediation must follow a specific order: disable persistence first, then rotate credentials. Broader mitigations include auditing pull_request_target workflows, tightening pnpm cache key scoping, setting minimum release age policies, and upgrading to pnpm 11. ## Content ## What happened On May 11, 2026, attackers published 84 malicious versions across 42 `@tanstack/*` npm packages within a six-minute window. The campaign, attributed to a threat group called TeamPCP and the self-propagating worm known as Mini Shai-Hulud, eventually spread to over 170 npm and PyPI packages total, including Mistral AI's SDK, UiPath packages, and several others. This wasn't a typosquat or a stolen password. The attackers hijacked TanStack's legitimate CI/CD pipeline, which is why the malicious packages came with valid SLSA Build Level 3 provenance attestations. Cryptographic signing didn't help here because the attacker rode the real build process. ## How the attack chain worked Three vulnerabilities were chained together: **1. Pwn Request via `pull_request_target`** The attacker submitted a pull request that triggered a GitHub Actions workflow using the `pull_request_target` event. This event runs in the context of the *base* repository rather than the fork, meaning fork-controlled code got access to base repo secrets. This class of misconfiguration is well-documented but still common. **2. pnpm cache poisoning** The malicious PR code tampered with the shared pnpm store during the CI run. Because GitHub Actions caches persist across workflow runs and the cache key wasn't scoped tightly enough, the poisoned cache carried over into subsequent legitimate builds. **3. OIDC token extraction from runner memory** From inside the compromised runner, the attacker extracted a short-lived OIDC token from process memory. That token was enough to publish to npm under the legitimate TanStack identity, no maintainer password or 2FA required. The result: malicious packages published through the real pipeline, signed with real provenance, indistinguishable from legitimate releases by automated trust checks. ## What the payload does Each compromised package contained a hidden `optionalDependency` pointing to an orphaned GitHub commit, which pulled in `router_init.js`, a heavily obfuscated ~2.3 MB script. On install, a `prepare` script executed it via Bun. The payload: - Harvests credentials from AWS (including IMDSv2), GCP, Kubernetes service accounts, HashiCorp Vault, GitHub tokens, npm tokens, SSH keys, and CI/CD environment variables - Searches for Claude Code session history files and VS Code task configs - Exfiltrates everything via the Session/Oxen P2P network to `filev2.getsession.org` - Self-propagates by using stolen npm tokens to publish new compromised versions of any package the victim has publish access to - Installs persistence hooks into `.claude/` and `.vscode/tasks.json` - On systems with Israeli or Iranian locale settings, runs a destructive wiper component The dead man's switch is the part that makes remediation genuinely dangerous: if a stolen GitHub token is revoked before the malware is removed, it triggers `rm -rf ~/`, wiping the user's home directory. **Do not rotate credentials before disabling persistence mechanisms.** ## How to identify if you're affected Check your lockfile for any `@tanstack/*` versions published on May 11, 2026. Specific indicators: - `@tanstack/setup` appearing in `optionalDependencies` - A `router_init.js` file present in the package tarball - Outbound connections to `filev2.getsession.org` - Unexpected files in `.claude/` or `.vscode/tasks.json` - Unfamiliar services running that monitor GitHub token validity Affected packages include `@tanstack/react-router` (12M+ weekly downloads) and 41 other packages in the namespace. The worm spread to 200+ additional packages across the ecosystem. ## Remediation order matters 1. **First**: audit and disable persistence mechanisms (check `.claude/`, `.vscode/tasks.json`, running services) 2. **Then**: rotate all credentials reachable from the affected host — GitHub tokens, npm tokens, AWS keys, Kubernetes service accounts, SSH keys, Vault tokens, anything 3. Revoke OIDC federation grants 4. Block `*.getsession.org` at the DNS level 5. Audit recent npm publish activity from your account 6. Check lockfiles for any installs from the May 11 window All 84 malicious versions have been deprecated and npm security pulled the tarballs. TanStack has unpublished the affected packages. ## Broader lessons The most uncomfortable part of this incident is that SLSA provenance didn't help. The packages were signed correctly because they went through the real build pipeline. Trusting provenance attestations as proof of safety assumes the pipeline itself hasn't been compromised — and here it was. A few concrete mitigations worth implementing: - Audit any GitHub Actions workflows using `pull_request_target` and ensure they don't expose secrets to fork-controlled code - Scope pnpm cache keys tightly so they can't cross trust boundaries - Set a minimum release age policy in your package manager so brand-new versions don't get installed automatically - Upgrade to pnpm 11, which includes fixes relevant to this attack vector - Pin dependencies with lockfiles and verify integrity on install TeamPCP has run similar campaigns before, including compromises of Bitwarden CLI and Aqua Security's Trivy scanner. This isn't a one-off. --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#github-actions](https://daily.dev/tags/github-actions), [#npm](https://daily.dev/tags/npm), [#tanstack](https://daily.dev/tags/tanstack) [View this post on daily.dev](https://daily.dev/posts/tanstack-npm-packages-compromised-in-active-supply-chain-attack-spreading-across-the-ecosystem-rjww2uayh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"TanStack npm packages compromised in active supply chain attack spreading across the ecosystem","url":"https://daily.dev/posts/tanstack-npm-packages-compromised-in-active-supply-chain-attack-spreading-across-the-ecosystem-rjww2uayh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tanstack-npm-packages-compromised-in-active-supply-chain-attack-spreading-across-the-ecosystem-rjww2uayh"},"datePublished":"2026-05-11T22:28:18.766Z","dateModified":"2026-05-13T17:07:40.510Z","description":"On May 11, 2026, attackers from TeamPCP published 84 malicious versions across 42 @tanstack/* npm packages in six minutes by chaining three vulnerabilities: a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/68614ed52983a48469a1697860e1a683?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/68614ed52983a48469a1697860e1a683?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tanstack-npm-packages-compromised-in-active-supply-chain-attack-spreading-across-the-ecosystem-rjww2uayh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,github-actions,npm,tanstack","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"TanStack npm packages compromised in active supply chain attack spreading across the ecosystem"}]} ```